Touch ID for sudo (collar)

collar is the small-but-mighty auth room. It enables Touch ID for sudo so privileged commands take a fingerprint instead of a typed password — and, crucially, it makes that work inside a terminal multiplexer like zellij or tmux, where stock Touch-ID-for-sudo silently fails.

What it turns on

collar configures two PAM settings for sudo, and installs one sudoers rule:

security.pam.services.sudo_local.touchIdAuth = true;   # fingerprint for sudo
security.pam.services.sudo_local.reattach   = true;    # make it work in tmux/zellij

• touchIdAuth adds the Touch ID PAM module to sudo.
• reattach pulls in pam_reattach, which reattaches the sudo process to your GUI login session.
• /etc/sudoers.d/darwin-rebuild exempts one command from authentication entirely — see below.

The one command that never asks

Activating a build is the privileged thing this rice does constantly, and a prompt per rebuild buys nothing: you already authenticated to build it. So collar grants that one command a pass:

<you> ALL=(ALL) NOPASSWD: /run/current-system/sw/bin/darwin-rebuild

haus rebuild and bench try switch both route through that exact path, so rebuilds run straight through. Nothing else is exempt.

Why the stable path, not the store path

macOS 26.6 shipped sudo 1.9.17, which stopped dereferencing a command’s symlink before matching sudoers. A rule written against /nix/store/…-darwin-rebuild/… now matches only if you type that store path literally — which nobody does — so the exemption silently stops applying and Touch ID quietly returns on every rebuild. Matching /run/current-system/sw/bin/darwin-rebuild is what survives.

One cosmetic wrinkle: nix-darwin’s environment.etc is symlink-only, so the rule lands as a 0444 store symlink and visudo -c may grumble that it “should be 0440”. Harmless — sudo refuses group/world-writable sudoers files, not merely readable ones.

Why the reattach matters

Without pam_reattach, running sudo inside zellij or tmux detaches from the Aqua GUI session, so the Touch ID prompt has nowhere to appear — it just beachballs. With it, the prompt reattaches to your GUI session and the sensor lights up as expected. If you cancel, it falls back to a typed password.

Yes, it works inside zellij

The payoff: type sudo -v in a zellij pane and the macOS Touch ID dialog floats up right over the multiplexer. Touch the sensor, and the command runs — no password typed. (darwin-rebuild is the exception, and a happier one: it doesn’t even ask.)

What it does not do

collar deliberately stays out of key management. YubiKey and GPG are kept out of Nix: key material, smartcard setup, and pinentry live outside the rice, handled by gpg-agent + pinentry-mac at runtime. This keeps secrets off the Nix store and lets you manage hardware keys the normal way.

Commit signing itself is wired up in hearth from your nebelhaus.git.signingKey — collar only handles the sudo authentication path.

Nothing to configure

collar has no options of its own — it’s on as part of the rice. If you ever want to opt out, remove or override the two PAM settings (and the sudoers rule, if the passwordless rebuild isn’t to your taste) in your host file. For most people it just works from the first switch, and typing your password to sudo becomes a memory.